Which activity is part of documenting risk assessment outcomes?

• A. Deleting old assets from inventory.
• B. Rebooting servers.
• C. Increasing network bandwidth.
• D. Recording identified assets, threats, vulnerabilities, risk ratings, and chosen controls.

Answer: (D)

Documenting risk assessment outcomes means capturing all the results of the assessment in a formal record: the assets being evaluated, the threats they face, the vulnerabilities found, the resulting risk ratings, and the controls chosen to address those risks. This kind of documentation creates a traceable, communicable record that supports risk treatment decisions, accountability, and ongoing monitoring. The other options describe operational actions or asset management tasks—like removing assets, restarting systems, or increasing bandwidth—not the act of recording the assessment results.